{"schema":"vulnpedia.poc/1","cve":"CVE-2026-102489","generated":"2026-10-26T13:52:32.101Z","kev":{"since":"2026-10-02","ransomware":false},"epss":{"score":0.01955,"percentile":0.80128},"cvss":{"version":"4.0","score":8.7,"severity":"HIGH","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:A/AU:Y/V:C"},"has_public_poc":true,"poc_sources":[{"kind":"vulncheck-xdb","url":"https://vulncheck.com/xdb/a1738d002f00","executable":false,"sourceId":"a1738d002f00","verification":"catalogued","source":"vulncheck-kev","modified":"2026-09-30T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"a1738d002f00","modified":"2026-09-30T00:00:00Z","url":"https://vulncheck.com/xdb/a1738d002f00"}],"repositoryUrl":"https://github.com/horizon3ai/CVE-2026-102489"},{"kind":"vulncheck-xdb","url":"https://vulncheck.com/xdb/686fd6ff8f76","executable":false,"sourceId":"686fd6ff8f76","verification":"catalogued","source":"vulncheck-kev","modified":"2026-09-30T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"686fd6ff8f76","modified":"2026-09-30T00:00:00Z","url":"https://vulncheck.com/xdb/686fd6ff8f76"}],"repositoryUrl":"https://github.com/1xPwn/CVE-2026-102489"}],"detection_sources":[],"discovery_links":[{"kind":"github-search","url":"https://github.com/search?q=%22CVE-2026-102489%22&type=repositories","executable":false}],"poc_candidates":[{"url":"https://github.com/horizon3ai/CVE-2026-102489","source":"poc-in-github","sourceId":"CVE-2026-102489","description":"Zammad Session Leak to Remote Code Execution","modified":"2026-10-20T16:49:50Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-102489","url":"https://github.com/horizon3ai/CVE-2026-102489"},{"source":"poc-in-github","sourceId":"CVE-2026-102489","modified":"2026-10-20T16:49:50Z","url":"https://github.com/horizon3ai/CVE-2026-102489"}],"tags":[]},{"url":"https://github.com/Hunt-Benito/the-cookie-in-the-error-message-cve-2026-102489-zammad-session-hijack-to-rce","source":"poc-in-github","sourceId":"CVE-2026-102489","modified":"2026-10-07T09:56:01Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-102489","url":"https://github.com/Hunt-Benito/the-cookie-in-the-error-message-cve-2026-102489-zammad-session-hijack-to-rce"},{"source":"poc-in-github","sourceId":"CVE-2026-102489","modified":"2026-10-07T09:56:01Z","url":"https://github.com/Hunt-Benito/the-cookie-in-the-error-message-cve-2026-102489-zammad-session-hijack-to-rce"}],"tags":[]},{"url":"https://github.com/1xPwn/CVE-2026-102489","source":"poc-in-github","sourceId":"CVE-2026-102489","description":"CVE-2026-102489 exploit in golang","modified":"2026-10-20T16:49:53Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-102489","url":"https://github.com/1xPwn/CVE-2026-102489"},{"source":"poc-in-github","sourceId":"CVE-2026-102489","modified":"2026-10-20T16:49:53Z","url":"https://github.com/1xPwn/CVE-2026-102489"}],"tags":[]}],"test_commands":[{"tool":"poc.json","cmd":"curl -s https://vulnpedia.com/cve/CVE-2026-102489/poc.json","note":"Machine-readable PoC index for this CVE (for automation)."}]}